What Is zrok by NetFoundry?

zrok is an open-source, zero-trust peer-to-peer tunneling and ingress tool from NetFoundry, built on the OpenZiti networking platform. It lets you expose an application, file, or web resource to a specific person or to the public through a secure overlay network, and it is available either as the hosted zrok.io service or as a self-hosted deployment. It fits best when you want quick, secure sharing without opening inbound ports or standing up a VPN, and when you are comfortable running a command-line client.

What zrok actually does

The core job is tunneling: a resource on your machine or network becomes reachable by someone else without a public endpoint being exposed in private mode. According to the project's own description, zrok provides "private or public, instant, secure tunneling of applications from anywhere," secured by the Zero Trust overlay network that OpenZiti supplies.

Two modes matter for choosing it:

• Private sharing — resources are shared with other zrok users and are not exposed to public endpoints; traffic moves between zrok clients over the overlay.
• Public sharing — a resource is made reachable more broadly, which is the mode you want for a demo, webhook target, or temporary public URL.

The project also positions itself as more than an HTTP proxy. It supports sharing files and web content, and its framework is designed to be extended to other kinds of decentralized, peer-to-peer resource sharing.

How you get started

The site describes a three-step flow, and each step has a clear input and expected result:

1. Invite — download the binary for your platform, then run zrok2 invite to create an account with the service. Expected result: your account is registered with the zrok instance you are using.
2. Enable — run zrok2 enable to enable your shell environment for sharing. Expected result: your shell is configured to talk to the service.
3. Share — run zrok2 share to share a resource. Expected result: a share is created and the connection details are produced for you to pass on.

The project's claim is that you can be "up and sharing with zrok in minutes." The practical prerequisites are a supported platform binary and, for the hosted service, an account created through the invite step.

SaaS or self-hosted

This is the main decision point, and the site frames it as "choose your own adventure":

The single zrok binary is described as containing everything needed to operate zrok environments and host your own service instances — "just add a Ziti network." If you need control over where traffic terminates or you are sharing inside an organization, self-hosting is the relevant path; if you want to try the tool or share occasionally, the hosted instance removes the operational work.

Where it fits and where it doesn't

zrok is a reasonable fit when you need to:

• Give a collaborator temporary access to a service running on your laptop or a private host.
• Share files or static web content without uploading them to a third-party storage service.
• Publish a short-lived public endpoint for testing a webhook or integration.

It is a weaker fit if you want a managed reverse proxy with no client software, or if your organization requires all traffic to terminate in infrastructure you already control and you are not prepared to run OpenZiti.

The open-source angle

zrok is built on OpenZiti, which the site describes as a free open-source project focused on bringing Zero Trust to any application. That matters for evaluation in two ways: the security model is inherited from a separately documented platform rather than invented for the tunneling tool, and the self-hosted path depends on you running that platform. If Zero Trust networking is a requirement in your environment, the OpenZiti foundation is the part worth reading up on before you commit.

Pricing for the hosted service is not specified in the material available here; check the pricing page on zrok.io before assuming the hosted instance is free for your use case.